This section provides information on how to improve an agent's readiness, listed in order of effort:

Documenting the Agent

Six governance data points cannot be discovered automatically because they describe business context rather than technical configuration. These data points include owner, criticality, purpose, data classification, PII exposure, and human-approval policy status. Documenting this information is often the fastest way to improve Governance Completeness because it immediately populates six of the 48 governance data points. 

For information about documenting agents and assets, see: Documentation.

Enabling Model-Level Protections

Model-level protections are not configured in Compliance Manager. They are configured in the source AI platform, such as Azure AI Foundry, and Compliance Manager discovers and reports those settings. The six content-safety controls are inherited from the model used by the agent. As a result, enabling model-level protections once can improve six governance data points for every agent that uses that model. 

For information about configuring model-level protections, see the documentation from your AI platform provider.

Closing the Visibility Gaps

  1. Log in to the Cryptographic Security Platform Compliance Manager as a tenant administrator.
  2. From the left menu, select AI Assets. The AI Assets page appears.
  3. Select the required agent.
  4. In the Governance Readiness section, select View Details.

  5. Review the data points marked as Not enough evidence. Some entries resolve automatically after Compliance Manager discovers the agent's relationships to models, infrastructure, tools, and secrets. Other entries indicate information that is unavailable from the source platform or has not been documented.

Addressing the Not Configured Entries

Not configured entries represent known governance gaps. These entries indicate that a governance data point can be configured, but Compliance Manager has determined that it is not currently enabled. Unlike Not enough evidence entries, which indicate that the status cannot be determined, Not configured entries indicate that the status is known and not enabled. On the AI Assets page, review the governance data points marked as Not configured to identify known governance gaps.